CVE-2026-62824

Remote Desktop is the feature people use to connect to another computer as if they were sitting in front of it. This vulnerability is a flaw in the Windows Remote Desktop Client that can be triggered by a specially made connection/session. If it’s triggered, an attacker may be able to run malicious code on your machine over the network.

This matters if your business uses or runs Windows 10, Windows Server 2012, Windows Server 2012 R2, or Windows Server 2016 systems with the Remote Desktop Client available and reachable in normal use.
It becomes a risk when an attacker can connect to you and deliver a crafted Remote Desktop session that the client processes; the attack is designed to be remote, and a victim action such as connecting/opening the session may be involved.

This is RED because it’s a remote code execution vulnerability in a core networking feature (Remote Desktop Client), and attackers with serious intent have been publicly associated with this kind of activity (Lazarus group) alongside active patching. There is no public exploit code on record, but you should not wait—patch availability is confirmed for all affected Windows versions, and the risk is driven by remote reachability and session handling.